thermo-nuclear-code-quality-review
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted external data.
- Ingestion points: Untrusted code and diff data are ingested via the user prompt sections typically labeled as 'Git / diff output' and 'Changed file contents' as defined in the SKILL.md.
- Boundary markers: The skill lacks explicit instructions for the agent to ignore or isolate instructions that may be embedded within the code or git diffs being analyzed.
- Capability inventory: The skill does not request or utilize any platform tools such as shell, file system, or network access in its frontmatter, which restricts any potential impact of successful injection to the generated review text.
- Sanitization: No input sanitization or validation of the provided code contents is performed.
Audit Metadata